Programmatic computer problem diagnosis and resolution and automated reporting and updating of the same

Abstract

Programmatically diagnosing the root cause of a problem in a computing system. Events are monitored within an operating system, and at least a subset of the events are logged to a log file. In response to the detection of error condition(s), a diagnostics module is invoked. The diagnostics module queries the log file to correlate events relevant to diagnosis of the problem, and identifies the root cause by evaluating the results of the query. Once the root cause of the problem is diagnosed, a resolution module corresponding to that root cause may be invoked to programmatically resolve the problem. The invocation of the diagnostic and resolution modules may be subject to policy rules. Furthermore, the logging, diagnostics and resolution modules may be automatically updated as needed.

1. In a computing system that executes an operating system, a method for programmatically diagnosing the root cause of a problem in the computing system, the method comprising the following:
 an act of generating events within an operating system; 
 an act of logging at least a subset of the events to a log file; 
 an act of detecting one or more error conditions, and thereafter; 
 an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked:
 an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions; 
 an act of evaluating the results of the query; and 
 an act of identifying the root cause of the one or more error conditions in response to the evaluation; and 
 
 an act of receiving one or more updates, wherein the updates modify which events are logged. 
 
   
   
     2. A method in accordance with  claim 1 , further comprising the following after the act of detecting one or more error conditions:
 an act of consulting rules to determine that the diagnostic module should be invoked according to the rules. 
 
   
   
     3. A method in accordance with  claim 2 , further comprising the following:
 an act of receiving user input to set the rules. 
 
   
   
     4. A method in accordance with  claim 1 , further comprising the following:
 an act of sending at least a subset of the results of the query to an error reporting service. 
 
   
   
     5. A method in accordance with  claim 4 , further comprising the following:
 an act of receiving one or more updates, wherein the updates alter how the diagnostics module diagnoses. 
 
   
   
     6. A method in accordance with  claim 1 , wherein the updates further alter how the diagnostic module diagnoses. 
   
   
     7. A method in accordance with  claim 1 , wherein the updates further alter how the diagnostics module diagnoses. 
   
   
     8. A method in accordance with  claim 1 , further comprising the following:
 an act of invoking a resolution module in response to the act of identifying the root cause of the one or more error conditions, the resolution module configured to do the following when invoked:
 an act of resolving the root cause of the one or more error conditions. 
 
 
   
   
     9. A method in accordance with  claim 8 , further comprising the following after the act of detecting one or more error conditions:
 an act of consulting rules to determine that the resolution module should be invoked according to the rules. 
 
   
   
     10. A method in accordance with  claim 9 , further comprising the following: an act of receiving user input to set the rules. 
   
   
     11. A method in accordance with  claim 8 , further comprising the following:
 an act of sending at least a subset of the results of the query to an error reporting service. 
 
   
   
     12. A method in accordance with  claim 11 , wherein the updates further alter how the diagnostic module diagnoses. 
   
   
     13. A method in accordance with  claim 12 , wherein the updates further alter how the resolution module resolves. 
   
   
     14. A method in accordance with  claim 11 , wherein the updates alter how the diagnostic module diagnoses. 
   
   
     15. A method in accordance with  claim 14 , wherein the updates further alter how the resolution module resolves. 
   
   
     16. A method in accordance with  claim 11 , wherein the updates alter how the resolution module resolves. 
   
   
     17. A method in accordance with  claim 1 , further comprising the following:
 an act of determining that the root cause of the one or more error conditions cannot be programmatically resolved; and 
 an act of engaging a user interface module to prompt the user to enter additional information to be used by the diagnostic or resolution module to attempt to identify or resolve the problem. 
 
   
   
     18. A method in accordance with  claim 1 , wherein the user interface module is a trouble shooting wizard. 
   
   
     19. A computer program product for use in a computing system that executes an operating system, the computer program product for implementing a method for programmatically diagnosing the root cause of a problem in the computing system, the computer program product comprising:
 one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:
 an act of generating events within an operating system; 
 an act of logging at least a subset of the events to a log file; 
 an act of detecting one or more error conditions; 
 an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked:
 an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions; 
 an act of evaluating the results of the query; and 
 an act of identifying the root cause of the one or more error conditions in response to the evaluation; and 
 an act of receiving one or more updates, wherein the updates modify which events are logged. 
 
 
 
   
   
     20. A computer program product in accordance with  claim 19 , wherein the one or more computer-readable storage media further have stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:
 an act of sending at least a subset of the results of the query to an error reporting service; and 
 an act of receiving one or more updates that alters how the diagnostic module diagnoses. 
 
   
   
     21. A computer program product in accordance with  claim 19 , wherein the one or more computer-readable storage media further have stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:
 an act of invoking a resolution module in response to the act of identifying the root cause of the one or more error conditions, the resolution module configured for resolving the root cause of the one or more error conditions when invoked. 
 
   
   
     22. A computer program product in accordance with  claim 19 , wherein the one or more computer-readable storage media further have stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:
 an act of sending at least a subset of the results of the query to an error reporting service; and 
 an act of receiving one or more updates that alters how the diagnostic module diagnoses; or alters how the resolution module resolves. 
 
   
   
     23. A computer program product in accordance with  claim 19 , wherein the one or more computer-readable storage media further have stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:
 an act of determining that the root cause of the one or more error conditions cannot be programmatically resolved; and 
 an act of engaging a user interface module to prompt the user to enter additional information to be used by the resolution module to attempt to identify or resolve the problem. 
 
   
   
     24. In a computing system that executes an operating system, a method for programmatically diagnosing the root cause of a problem in the computing system, the method comprising the following:
 an act of generating events within an operating system; 
 an act of logging at least a subset of the events to a log file; 
 an act of receiving one or more updates, wherein the updates modify which events are logged; 
 an act of detecting one or more error conditions; and 
 a step for programmatically diagnosing a problem evidenced by the one or more error conditions. 
 
   
   
     25. A method in accordance with  claim 24 , wherein the step for programmatically diagnosing a problem evidenced by the one or more error conditions comprises the following:
 an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked:
 an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions; and 
 an act of evaluating the results of the query; and 
 an act of identifying the root cause of the one or more error conditions in response to the evaluation. 
 
 
   
   
     26. A computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of a computing system, cause the computing system to instantiate in memory the following:
 an event logger configured to log events in a log file and to receive updates which modify which events are logged in the log file; 
 a problem detection module configured to detect a problem when one or more error conditions occur, and configured to cause a resolution module to be invoked in at least some circumstances when the problem is detected; and 
 a diagnosis module configured to query the log file, evaluate the results of the query, and diagnose the problem based on the evaluation. 
 
   
   
     27. A computer-readable storage media in accordance with  claim 26 , further having stored thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:
 a monitoring module that maintains rules regarding when the diagnosis module should be invoked, wherein the monitoring module causes the diagnosis module to be invoked in response to the problem detection module detecting the problem if the rules so permit. 
 
   
   
     28. A computer-readable storage media in accordance with  claim 26 , further having stored thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:
 a resolution module configured to resolve the problem when invoked, wherein the diagnosis module is further configured to cause the resolution module to be invoked in at least some circumstances when the diagnosis module diagnoses the problem. 
 
   
   
     29. A computer-readable storage media in accordance with  claim 28 , further having stored thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:
 a monitoring module that maintains rules regarding when the resolution module should be invoked, wherein the monitoring module causes the resolution module to be invoked in response to the diagnosis module diagnosing the problem if the rules so permit. 
 
   
   
     30. In a computing system that executes an operating system and that is network connected to an error reporting service, a method for determining the root cause of a problem in the computing system, the method comprising the following:
 an act of generating events within an operating system; 
 an act of logging at least a subset of the events to a log file; 
 an act of detecting one or more error conditions, and in response thereto: 
 an act of querying the log file to correlate relevant events, 
 an act of sending at least a subset of the results of the query to an error reporting service; and 
 an act of receiving one or more updates, wherein the updates modify which events are logged, what diagnostic steps are to be taken, or what resolution steps are taken by the computer system's operating system or recommended to the end user. 
 
   
   
     31. A computer program product for use in a computing system that executes an operating system and that is network connected to an error reporting service, the computer program product for implementing a method for determining the root cause of a problem in the computing system, the computer program product comprising:
 one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:
 an act of generating events within an operating system; 
 an act of logging at least a subset of the events to a log file; 
 an act of detecting one or more error conditions, and in response thereto: 
 an act of querying the log file to correlate relevant events, 
 an act of sending at least a subset of the results of the query to an error reporting service; 
 and an act of receiving one or more updates, wherein the updates modify which events are logged, what diagnostic steps are to be taken, or what resolution steps are taken by the computer.